PayID (New Payments Platform)

Detects Australian PayID payment addresses used on the New Payments Platform (NPP). A PayID is an email address, mobile phone number (+61 / 04xx format), ABN or organisation identifier registered as a real-time payment alias, detected when it appears near an explicit PayID label in a payment context.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Medium confidence: the PayID label plus a co-located payment-address value (email, +61/04xx mobile, or ABN) is a strong signal, but a PayID reuses common identifier shapes, so corroborating NPP/Osko payment keywords are required to separate real payment instructions from generic contact details.
Jurisdictions: au
Regulations: AML/CTF Act (Cth), NDB Scheme (Cth), Privacy Act 1988 (Cth)
Frameworks: ISO 27001, ISO 27701
Data categories: financial, pii
Scope: narrow
Risk rating: 6
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?i)\bpay[\s-]?id\b\s*(?:number|address|is)?\s*[:=#-]?\s*(?=[\s\S]{0,80}?(?:[A-Za-z0-9._%+-]{1,40}@[A-Za-z0-9.-]{1,40}\.[A-Za-z]{2,10}|\+61[\s-]?4\d{2}[\s-]?\d{3}[\s-]?\d{3}|\b04\d{2}[\s-]?\d{3}[\s-]?\d{3}\b|\bABN[:\s]*\d{2}\s?\d{3}\s?\d{3}\s?\d{3}\b))

Corroborative evidence keywords

PayID, New Payments Platform, NPP, Osko, Osko payment, payment address, pay anyone, real-time payment, PayID registration, PayID name, financial institution, faster payments, BSB, beneficiary account, transfer funds, send payment

Proximity: 300 characters

Should match

Please pay via PayID: john.smith@example.com to settle the invoice by Friday
My PayID is 0412 345 678 linked to my everyday account with the bank
Send the funds to PayID +61 412 345 678 registered with NAB via Osko
Business PayID ABN 51 824 753 556 registered for the invoice payment

Should not match

PayID lets you send money using just a mobile number or email address
Employee ID 12345 recorded in the payroll system this morning
Your payment reference is INV-2024-0087 for this transaction
PayID number 51 824 753 556 noted in the shared spreadsheet

Known false positives

A PayID label followed by a contact email or phone that is not actually a registered payment alias may match. Mitigation: Require corroborating NPP/Osko payment keywords within the proximity window before treating a match as a payment instruction.
Sample or tutorial payment instructions in onboarding material can contain the PayID label and a value. Mitigation: The high and medium tiers apply the template-exclusion NOT-group to suppress sample and training content.